SVππ╔«*
*
*
*
#
ÆÆÆÆÖ/kvvÜÜÜÜ»∞ ∞ ∞ »α"α"~%I(Z*Z*Z*Z*₧-₧-■0ü4╟7]9ù:V<*=═>═>NDNDA½B;G¬H∙J╖K╖K╖K▒MτNτNÖPÖPSVTÆUπVúX≤X°[E]ü^≥_Ebóbób┘d*f*f╜hdjlbmbm¡oq╞rªvXxU{ç|~MÇvü┘ä┌äLç▒ë≥è═ïì8Å≥ÉHÆ⌡ô!òσû¡ÿ╙Ö'¥5ƒ9óÉú$ÑPºα¿½₧½≥¡▒M└»(▓VT*
9┤9┤9┤'╖Ü╖■╕┌║╘╝║╛╗╛╗╛#┬Å├J╞K╚ÜP╩Q╩R╩S╩T╩╝╠┘dü^├▐─▐┼▐╞▐╟▐╚▐╔▐╩▐╦▐╠▐═▐╧∙╨╬▐╥╘╙╘╙╧▐╨▐T╩╤▐╥▐5ƒ-╓ç┘╙▐╘▐╒▐╓▐╫▐╪▐┘▐┌▐█▐▄▐║█▌▐▐▐*
*
*
▀▐α▐ß▐Γ▐π▐Σ▐σ▐µ▐τ▐Φ▐Θ▐Ω▐δ▐∞▐φ▐ε▐∩▐≡▐±▐≥▐≤▐⌠▐⌡▐÷▐≈▐°▐∙▐·▐√▐ⁿ▐²▐■▐ ▐▀▀▀▀▀▀▀▀▀	▀
▀▀▀
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀!▀"▀#▀$▀%▀&▀'▀(▀)▀*▀+▀,▀-▀.▀/▀0▀1▀2▀3▀4▀5▀6▀7▀8▀9▀:▀;▀<▀=▀>▀?▀@▀A▀B▀C▀D▀E▀F▀G▀H▀I▀J▀K▀L▀M▀N▀O▀P▀Q▀R▀S▀T▀U▀V▀W▀X▀Y▀Z▀[▀\▀]▀^▀_▀`▀a▀b▀c▀d▀e▀f▀g▀h▀i▀j▀k▀l▀m▀n▀o▀p▀q▀r▀s▀t▀u▀v▀w▀x▀y▀z▀{▀|▀}▀~▀▀Ç▀ü▀é▀â▀ä▀à▀å▀ç▀ê▀ë▀è▀ï▀î▀ì▀Ä▀Å▀É▀æ▀Æ▀ô▀ö▀ò▀û▀ù▀ÿ▀Ö▀Ü▀¢▀£▀¥▀₧▀ƒ▀á▀í▀ó▀ú▀ñ▀Ñ▀ª▀º▀¿▀⌐▀¬▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀½▀Σ▀?ßΓ4ΣrσName: @DataCrime (A,B)          Discovered: March 1989
      @Columbus Day

Non resident virus, infects COM programs

Symptoms:
This virus infects other programs when an infected program is run.
On September 12, this virus will write a message reading:
"1 March 1989 - DataCrime Virus"
Then will format the first track of the hard disk.
This virus will not infect any COM file where the seventh letter
of the name is 'D' (including COMMAND.COM).
Loads itself into memory with MCBs.
Name: @Datacrime II

Non-resident virus, infects COM and EXE files

Symptoms:
Mode of operation similar to other Datacrime versions.
Every time an infected program is executed, the virus will search
for clean programs in all drives and infect the first non-infected
program found, including COMMAND.COM.
On September 12, this virus will write a message reading:
"1 March 1989 - DataCrime Virus"
Then it will format the first track of the hard disk.
Loads itself into memory with MCBs.
Name: @Tuesday

Resident virus, infects COM and EXE programs

Symptoms:
A memory resident copy of this virus will infect every COM file
executed.
This is a strain of the Jerusalem (Friday 13th) virus, active
on Tuesday the 1st.
Name:  @Sunday

Resident virus, infects COM and EXE files

Symptoms:
This virus was discovered by many users in the Seattle, Washington
area in November, 1989.
Variant of the Jerusalem virus, that becomes active on Sundays and
displays the message:
"Today is Sunday! Why do you work so hard?"
"All work and no play make you a dull boy."
"Come on! Lets go out and have some fun!"
Name: @Jerusalem (or strain of Jerusalem)   Discovered: July 1987
      @Friday 13th/@Black Hole/@Russian/@Israeli/@sUMsDos
      @PayDay/@Frere Jacques/@Spanish

Resident virus, infects COM and EXE programs

A memory resident copy of this virus will infect every COM file
executed.
COM programs grow by approx. 1800 bytes, then stop growing.
EXE programs keep growing until they are too large to be loaded
in the memory.

Symptoms:
Screen disintegrates, and black "holes" appear on screen.
The computer slows down every thirty minutes or every hour
(depending on the version of the virus).
In the original version, on Friday the 13th, any file executed
will be erased.
Other strains activate on different events.
More that 20 strains of this virus are known!
Name: @sURIV 3.00
      @Jerusalem E

Resident virus, infects EXE and COM programs

Symptoms:
"sURIV 3.00" operates in a similar manner to the Jerusalem virus.
However, it does not delete programs on Friday the 13th
Also, the effective length is 1808.  The infection test is the
string "sURIV" at the end of the infected program.
Destroys the file allocation table.
Name: @1701/@1704
      @Cascade/@Fall/@Russian/@BlackJack/@Autumn Leaves

Infects COM Programs (some variations will not infect true IBM PCs)

Symptoms:
The virus is encrypted. A memory resident copy of it infects every
COM file executed, including COMMAND.COM. A cascade will be
displayed if the system date is between October and December 1988.
Each of the variants will attach itself to programs infected by the
other variant.
The trigger of the cascade display causes characters to "fall"
to the bottom of the screen, stacking all the characters in
their respective columns. The display is restricted to one column
at first. Then the number of columns multiplies until the full screen
is involved. One of the versions includes the formatting routine from
the 1168 variant of Datacrime, and the date routine has been altered.
The virus  tries to format track zero of the hard disk on any date in 
the last three months of the year, except if the year is  1993.
Formatting is performed after five minutes, followed by beeping.
Name: @Fu Manchu

Resident Virus. Infects COM and EXE Programs

Symptoms:
Memory resident copy infects every COM file executed except
COMMAND.COM. The  virus attaches itself to the beginning of the
file.  It is similar to the Jerusalem virus, with the exceptions
that the codes to delete files, slow down the computer, and
produce black windows have been removed.  Instead, the Fu Manchu
hooks itself onto the keyboard interrupt.
The message "The world will hear from me again!" is encrypted within
the virus, and will appear on the screen when CTRL+ALT+DEL is pressed.
Recent versions (after Aug. 1989) comment some politicians' names.
Whenever one of the following names is typed on the keyboard:
"Waldheim, Thatcher, Reagan or Botha", very insulting remarks go into
the keyboard buffer and appear inside any document being produced.
Generally speaking, this seems to be an improved version of the
Jerusalem virus.
Name: @Oropax
      @Mushroom
      @Music Virus

Resident virus, infects COM files

Symptoms:
Memory resident musical virus.
Any infected file is increased by between 2756 and 2806 bytes.
Its length is divisible by 51.
Five minutes after infection, it will play three different
tunes with a seven-minute interval.
Name:  @Lisbon

Non resident virus, infects COM Program files

Symptoms:
This virus is very similar to Vienna virus
When an infected file is executed, this non-resident virus will
search for the clean files through the PATH, selecting every 7th
file or any one reached when the system time is zero. It infects
the end of COM files and changes the seconds field to 62 seconds.
The first 5 bytes of the selected file are overwritten with the
string "AIDS", thus making it unusable.
This virus is not loaded onto the memory.
Name: @Ghost (COM+BOOT)
      @Ghostballs

Non resident virus, infects COM Programs and BOOT sectors

Symptoms:
This is the first known virus that can infect both files and disk
Boot Sectors!
This virus is a strain of the Vienna virus, and attaches itself
to the end of the file.   The seconds field is changed to 62, as
in Vienna.   When run, it will infect other COM files, and try to
place a modified copy of the Italian (Ping Pong) virus into the boot
sector of drive A:.  The  text "GhostBalls, Product of Iceland" is
contained in the virus.
Name: @Vienna (or Vienna strain)        Discovered: November 1989
      @Austrian/@UNESCO/@DOS 62/@648 virus

Non resident virus, infects COM programs

Symptoms:
This virus was first isolated in Moscow at a UNESCO children's
computer summer camp. Because the source code listing of this virus
was published in a book, more that 20 other viruses are based on this
virus.
When an infected file is executed, this non-resident virus will
search for the clean files through the PATH, selecting every 7th
file or any one reached when the system time is zero. It infects
the end of COM files and changes the seconds field to 62 seconds.
The first 5 bytes of the selected file are overwritten.
This virus is not loaded onto the memory.
Some versions will corrupt one in every eight programs run.
Name: @April 1st (2 types)          Discovered: July 1987
      @sURIV 1.01

Resident virus, infects COM programs

Symptoms:
It is believed that this is the first file virus written for PC.
A memory resident copy of virus infects every COM file executed
by attaching itself to the beginning of the file.
Occasionally, and before normal termination, sends a message:
"YOU HAVE A VIRUS".
On April 1st,  it will send the following message:
"APRIL 1ST, HA HA HA YOU HAVE A VIRUS!"
However, nothing will happen if the date is before the year 1988.
Relatively easy to identify.
Name: @April 1st (4 types)
      @sURIV 2.01/sURIV 3.01

Resident virus, infects EXE and COM programs

Symptoms:
Fairly similar to the other types of April 1st, with the
exception that it uses MCBs in DOS instead of staying
resident.
Memory resident copy that infects every EXE file executed by
attaching itself to the beginning of the file, immediately after
the relocation table. On April 1st, it displays a message:
"APRIL 1ST, HA HA HA YOU HAVE A VIRUS!"
and destroys the file allocation table.
Name: @Traceback
      @Spanish Traceback

Resident virus, infects COM and EXE Programs

Symptoms:
A memory resident copy of Traceback infects every program file
executed including COMMAND.COM.  It adds itself to the end of
a program file.   If the program is a COM file, it stores the
first three bytes of the host program and replaces these bytes
with a branch of itself.   It also infects other programs via 
directory search.   The display is similar to CASCADE, but it can
be removed by entering keyboard characters. Display will repeat
every hour if nothing is typed on the keyboard for one minute.
Spanish Traceback is an earlier version of the Traceback virus.
Name: @Dark Avenger         Discovered: 1988 in Bulgaria
      @Eddie/@Bulgarian

Resident virus, infects EXE and COM programs

Symptoms:
Infects programs larger than 1774 bytes, every time a program
file is opened, closed or loaded for execution. This means
that virus-scan programs will infect every program on the disk
if memory is not cleaned prior to it. Also using DOS COPY or XCOPY
commands to copy uninfected files will cause both the source and
target files to be infected
The virus produces no visible symptoms but will sometimes
overwrite a Boot sector when an infected program is run.
In most cases, however, it will only increment a counter by one.
Contains a message:
"Eddie lives somewhere in time"
Name: @Sylvia
      @Holland/@Dutch girl

Resident virus, infects COM programs

Symptoms:
Changes the current drive to C:.   Infects all the files in the
root directory, in the current directory and files being executed.
Some files are destroyed, leaving behind only 1332 bytes that contain
the virus.   Displays a message, with the name Sylvia, giving her
address, and asking for a postcard in exchange for instructions how
to get rid of the virus.  Disables Write-Protect messages.
Loads itself into memory using MCBs in DOS.
Name: @Icelandic (1,2,3)
      @Saratoga

Resident virus, infects EXE files 

Symptoms:
This virus is a member of the Icelandic viruses group.
A memory resident copy of this virus infects one in ten (or one in
two in version B) EXE programs executed.
Icelandic 1: On systems with hard disks larger than 10 MB, the virus
             will select one unused FAT entry and mark it as a bad
             each time it infects a program.
Icelandic 2: Each time the virus infects a program, it will modify
             the file's date and time. It will also remove the
             read-only attribute from files, but does not restore it.
Icelandic 3: If an infected program is run on December 24th, programs
             subsequently run will be stopped and display the message:
             "Gledileg jol" ("Merry Christmas" in Icelandic).
Name: @MIX1 (A and B)       Discovered: September 1989
      @Icelandic
Size: A: 1618 bytes/B: 1636 bytes

Resident virus, infects EXE program files

Symptoms:
When an infected program is run, it copies itself to the top of 
the free memory.  Infection occurs in every tenth program run.
Garbled text and bouncing balls are produced.
This virus was initially transmitted through Bulletin Boards.
MIX-1 mixes the information transmitted through Serial and 
Parallel ports to printers or communication networks, by randomly
substituting text characters by different characters.
Fifty minutes after the virus becomes active in memory, it starts
substituting  the Caps-Lock key for the Num-Lock. On the hour,
it will display a bouncing "o", in a manner fairly similar to
the Ping Pong virus. When the virus is in the memory, any EXE
program over 8K will be infected.
Name: @Alabama             Discovered: September 1989

Resident virus, infects EXE programs

Symptoms:
This is one of the most vicious viruses.  It loads itself 30K under
the highest location reported by DOS, but does not lower the memory
size reported either by BIOS or by DOS!
It does not use the Int 21 Terminate Stay Resident function.
Alabama takes INT 9 (keyboard interrupt) and checks the keyboard for
the Warm Boot keys (the combination Alt+Ctrl+Del).   It boots the
computer using the Bootstrap routine and will keep lurking in memory.
Displays a message:
"SOFTWARE COPIES PROHIBITED BY INTERNATIONAL LAW"
"Box 1055 Tuscambia ALABAMA USA"
This virus does not infect the program being executed, but will search
for a clean file in current directory,  and infect it through direct
disk access interrupts.
On Fridays it will manipulate FATs and swap file names so that files
are slowly lost.
Name: @100 years                 Discovered: October 1989
      @4K/@4096/@IDF/@Frodo

Resident virus, infects EXE and COM programs

Symptoms:
The first known virus of stealth family, probably written in Israel.
Shows the original programs 4K smaller than actual.
Adds 100 years to the date, but since DOS shows only the last two
digits of the date, it goes unnoticed.
Recognizes the infected file,  then reduces its size by 4K when a
DOS command is executed.
Mapping utilities (SMAP, MAPMEM etc.) cannot detect the interrupt
changing by the virus.
It loads to the highest memory location reported by DOS, but the
change is not shown by BIOS.   The DOS reports 6K less than actual
size.   CHKDSK will report "Allocation error",  and CHKDSK/F will
in most cases crash the disk.
This virus also infects data files with certain extensions !Name: @Typo (COM)                   Discovered: August 1989
      @Fumble

Resident virus, infects COM programs

Symptoms:
Searches for clean files in the current directory and infects
them on the first day of every month.  When no clean files are
found, it starts randomly replacing any character by the character
located to its right on the keyboard. For example S will become A,
K will become J, etc..
Name: @Do nothing
      @Stupid virus/@640K virus/@9800:0000

Resident virus, infects COM programs

Symptoms:
Attacks only systems with 640K or more.  When an infected file is
executed, it will search for clean files and infect them. It does
not do any harm to the computer.
Stays in memory at location 9800:0000
Name: @Zero Bug/@Palette

Resident virus, infects COM files, including COMMAND.COM

Symptoms:
Once in memory, it infects COM files, including COMMAND.COM on any
operation of the file like "COPY" or "XCOPY".
The virus's main objective is to infect COMMAND.COM indicated by
the environment variable COMSPEC.
After infection is completed, and a certain amount of time has past
a smiley face character will replace the zeros displayed on the
screen.
Name: @Perfume/@4711

Resident virus. Infects COM files

Symptoms:
Infects every COM file being executed. Randomly asks the user a
question and will not continue unless the answer is 4711 (the name
of perfume).
Name:  @Amstrad             Discovered: November 1989

Non resident virus, infects COM Programs

Symptoms:
Strain of Vienna virus, member of Pixel viruses family.
The virus itself is only 334 bytes long and when executed, displays
a message with an advertizement for Amstrad computers.
The virus will infect all clean COM files in current directory
The virus is not memory resident and causes no damage to the system.
Name: @Vacsina

Size: 1206 to 1221 bytes (COM)
      1338 to 1353 bytes (EXE)

Resident virus, infects EXE, COM and OVL Programs
There are more than 30 versions of this virus.
This is an early version of Yankee Doodle virus, written in Bulgaria
by somebody known as T.P.
Contains the string "VACSINA", which is Bulgarian for "VACCINE"
Symptoms:
Memory Resident virus that sounds a beep after a successful
infection of a program file.   It will infect any file executed.
Checks the version number of itself and replaces with newer code.
See also explanation about YANKEE virus
Name: @Syslock

Resident, encrypted virus. Infects COM and EXE files

Symptoms:
This virus will search the disk for files that contain the MicroSoft
trademark. Whenever the trademark appears, it is replaced by the
expression "MacroSoft".
This encrypted virus attaches itself to the end of a COM or EXE
file.   Infects a program one in four times when executed.
Does not infect if environment contains SYSLOCK=@.
Name: @MachoSoft

Resident, encrypted virus. Infects COM and EXE Programs

Symptoms:
This virus will search the disk for files that contain the MicroSoft
trademark. Whenever the trademark appears, it is replaced by the
expression "MachoSoft".
The virus will create a hidden file IBMIONET.SYS, that contains the
number of the last absolute disk sector number infected
Does not infect if environment contains VIRUS=OFF.
Name: @Yankee @Doodle         Discovered: September 1989

Resident virus, infects COM and EXE Programs
There are more than 50 different versions of this virus.
Each new version is capable of removing the old one.
Those viruses were written in Bulgaria by somebody known as T.P.

Symptoms:
When in memory infects every file executed.
Versions 5-26 have no noticeable effects, they are called "VACSINA".
Versions 26 to 32 will play "Yankee Doodle" melody when ALT-CTRL-DEL
  is pressed.
Versions 33 to 43 will play the melody when the system clock reaches
  05:00 or 17:00.
Version 42 and above will also seek and modify Ping Pong viruses,
  changing them so that they self-destruct after 100 infections.
Version 46 will remove Cascade (170X) virus.
Name: @VP        Discovered: May 1990

Non resident virus, infects COM files.

Symptoms:
When infected program is run, the virus will attempt to locate and
infect another COM file.   In some cases, the virus will display the
contents of the program being infected. In other cases, the virus may
try to execute the program being infected.  System usually slows down.
Name: @VirBas / @VBasic / @5120     Discovered: May 1990

Non resident virus, infects COM and EXE files

Symptoms:
This virus is was written in Turbo Basic. When an infected program
is executed, the virus will infect one COM and one EXE file in the
current directory. Then it will try to infect randomly selected COM
or EXE files in each directory on C: drive.
This virus does not check for disk write errors when trying to infect
programs.  Thus, disk write error messages may occur when no disk C:
exists in the system
Data files may become corrupted and crosslinking of files may occur.
Name: @8 Tunes

Resident virus, infect COM and EXE files except COMMAND.COM

Symptoms:
Infects every program executed.
Plays one of eight pre-programed tunes when certain conditions
occur.
Name: @Pixel 1/2/3

Non resident virus, infects COM programs

Symptoms:
This virus has three different version, sized: 354, 299, 277 bytes
The virus contains an internal counter which triggers the application
portion of the virus code.  When the infected program is executed,
after the counter signal has been set, the following message will
be displayed:
           "Program sick error:"
"Call doctor or buy PIXEL for cure description."

The smallest (277 bytes) version displays "PARITY ERROR" message.
Name: @Taiwan

Resident virus. Infects/Destructs COM Programs

Symptoms:
When an infected program is executed, the virus will search the
hard disk for a clean file and infect it.
The virus will place itself in the first 743 bytes in the file,
and the original code will be transferred to the end of the file.
Name:  @South African (A & B)
       @Virus-B/@Miami/@Munich

Resident virus. Infects COM Programs

Symptoms:
On friday, the 13th, if an infected file is executed, it will be
deleted. This virus has no connection to the Jerusalem virus,
except for the similar symptom.
Does not infect files with Read-Only flag set. Virus-B is
a non-destructive variant.
COMMAND.COM is not infected.  Any file run on Friday the 13th
will be deleted.
Name:  @dBase

Infects COM Program files

Symptoms:
Memory resident virus that transposes random bytes in dBase 
files that have the extension .DBF.  It keeps track of which files
and bytes were transposed in a hidden file (BUG.DAT) in the same
directory as the .DBF files
The virus restores these bytes if the file is read, so it appears
that nothing is wrong.  Once the BUG.DAT file is 90 days old or more,
the virus will overwrite the FAT and root directory on the disk.

This virus is particularly dangerous since its construction 
permits the corruption of long term backups without the user 
being aware of it.
Name: @Lehigh

Infects only COMMAND.COM

Symptoms:
This virus is a resident one, that infects only COMMAND.COM.
The infection mechanism is to overwrite the stack space.
After four infections, it trashes the disk FAT and Boot,
by overwriting them with 32 sectors of data from ROM BIOS.
It also changes the date and time of infected files.
Name: @Christmas
      @XA1 / @XA2 / @XMAS

Encrypted virus. Infects COM programs

Symptoms:
The virus will activate on April the 1st and destroy the partition
table of the hard disk!  From December 24th until January 1st it will
draw a full screen picture of a Christmas tree when an infected
program is executed.
Name: @Saturday 14th
      @Durban

Resident virus. Infects EXE and COM programs

Symptoms:
The virus activates every Saturday the 14th and causes the first
100 sectors of the A, B, and C drives to be overwritten.
The net result is loss of all of the information on those drives.
The Partition table, Boot Sector and FAT are destroyed.
Name: @Hallochen            Discovered: October 1989

Resident virus, infects COM and EXE programs

Symptoms:
This virus was reported by Christoff Fischer of the University
of Karlsruhe in West Germany. After entering memory, using MCB's,
this virus will infect any program file executed, unless it is
greater than 62K in size, or it's date falls within the current
month and year.
When infected files are run, input from the keyboard is garbled.
Name: @1355

Non resident virus, infects COM programs

Symptoms:
Not yet known
Name: @1260                  Discovered: January 1990

Infects COM programs

Symptoms:
First known fully encrypted virus.
This virus was designed to cause problems for anti-virus software.
The '1260' virus is based on Vienna virus.
Infected programs are marked by a value of 62 in the 'seconds'
field of the file time. When an infected program is run, the virus
will search the current directory for a new program to infect.
The virus appends itself to the program and does not stay resident
in memory.
The virus is stored in encrypted form, with a short routine at the
beginning of the file for decrypting itself. This routine is formed
randomly each time a new program is infected.   The effect of this
action is to make the pattern search of this virus very difficult.
Name: @405

Infects COM files only

Symptoms:
Infects one COM file (on a different disk) in the current
directory every time an infected program is executed and changes
it by overwriting the first 405 bytes. If the file is smaller
than 405 bytes, its size is increased to 405.
The virus does not recognize an already infected file.
Name: @AIDS Virus
      @Taunt
      @Hahaha

Infects/Destroys COM and EXE files

Symptoms:
When executed displays a message:
"Your computer now has AIDS"
and the computer is halted.  The virus is written in Turbo Pascal 3.
This virus overwrites the first 13K of the infected program,
destroying the original code.
Name: @Bulgarian @512
      @Number of The Beasts / @666

Resident virus. Infects/Destroys COM files

Symptoms:
This virus will write itself at the beginning of the file,
overwriting and destroying the original code.
The original code is placed after the end of file, but file length
is not increased. Thus CHKDSK will give an Allocation error on every
infected file.
Name:  @AIDS Information (Trojan)     December 1989
       @Trojan Horse

Symptoms:

Under the innocent appearance of a questionnaire about the
AIDS/HIV biological virus, thousands of diskettes containing this
Trojan horse were distributed.   When this diskette is installed
on a hard disk, the root directory is encrypted in an attempt to
destroy the hard disk.  The triggering mechanism is activated
after the AUTOEXEC.BAT is executed a certain number of times.
There is also a faking mechanism in this program that repeatedly
warns that the software lease has expired and should be
renewed.
Name: @Twelve @Tricks      @12 Tricks

Not a virus - @TROJAN HORSE

Symptoms:
Not yet known
Name:  @Stoned
       @Marijuana (A & B)       @New Zealand

Infects Partition Table Boot sector

Symptoms:
A relatively small virus that loads itself at boot time  (from
a floppy diskette only) to the end of the memory,  and lowers the
total memory reported by BIOS by 2K.   It infects the Master Boot
sector on the hard disk.  Occasionally (about once every eight
times), the message "Your PC is now stoned" will appear on screen.
This virus damages the File Allocation Table on some Hard Disks.
Contains a message: "Legalize Marijuana" at the end of Boot Sector.
Name:  @Den Zuk
       @Search

Resident virus. Infects Boot sectors

Symptoms:
Graphics "DEN ZUK" slides in from the sides of the screen
when the warm boot keys Alt-Ctrl-Del are pressed.
This message will be displayed only on CGA/EGA/VGA screens.
Some variants will format the floppy in the disk drive after a
certain number of boots.
Name:  @Brain
       @Pakistani

Resident virus, infects Boot sectors

Symptoms:
Sophisticated Boot sector virus.   It damages the boot sector so
that whenever the system is booted, the virus loads itself into
the memory before the operating system.  By the same token, the
Brain virus will exclude any possibility of removing it because
it prevents writing to or reading the Boot sectors.  It situates
itself in sectors marked as Bad, and takes up to 3K bytes.  It is
easy to recognize by merely checking the volume label, which the
virus changes to "(c) BRAIN."
The original version specifies the name and address of the writers
of this virus in Pakistan.
Name:  @Ashar
       @Shoe Virus

Resident virus, infects Boot sectors

Symptoms:
This is a variant of the Brain virus. In this version a message
in the virus is modified to be:
"VIRUS_SHOE RECORD, V9.0. Dedicated to the dynamic memories"
"of millions of virus who are no longer with us today"
This message is never displayed.
There is also a variation of the Ashar virus which creates a label
of "(c) ASHAR" (see Brain).
Name:  @Yale
       @Alameda
       @Golden Gate

Resident virus, infects Boot sectors

Symptoms:
Discovered at Merritt college in Alameda, California in 1987.
Infects in Drive A only during reboot.   Booting from hard disk
will not be allowed.   This virus is also warm-boot resistant,
and will stay lurking in memory after ALT-CTRL-DEL.
Does not run on 80286 or 80386.
This virus becomes memory resident and occupies 1K of RAM.
Name:  @Misspeller
       @Typo
       @Mistake

Resident virus, infects Boot sectors

Symptoms:
Presents striking similarities to the Ping Pong virus, and
operates in a similar manner, but cause words to appear to be
misspelled.
Exchanges  letters for phonetically similar ones (C for K)  while
they are being output to the printer.
Name:  @Ping Pong
       @Italian
       @Bouncing Ball

Resident virus, infects Boot sectors in both Hard Disks and floppies

Symptoms:
Whenever the computer is booted from an infected diskette, the
virus will enter the memory. It loads itself to the end of the
memory reported by BIOS, and lowers the total reported memory by
2K.  A bouncing ball will appear on the screen and remain there
until the computer is booted again.  This virus is very contagious.
It will mark one cluster as bad and load itself into that cluster
Some version of this virus will not run on 80286 nor 80386.
Name: @Pentagon

Resident virus. Infects Boot Sectors

Symptoms:
This virus changes the system filename in PC-DOS boot sector
to "HALBIO.COM" instead of "IBMBIO.COM".
This file contains the portion of virus code which would not
fit into the boot sector.
This virus is memory resident, occupying 5K, and can survive a
worm boot (ALT+CTRL+DEL).
Name: @SWAP                      Discovered: August 1989
      @Israeli BOOT
      @Falling Letters Boot

Resident virus. Infects Boot Sectors on floppies

Symptoms:
The infection is done only 10 minutes after boot. This virus uses
2K of memory.  When activated, a cascading effect of falling letters
appear on the screen, similar to 170X/Cascade virus.
Some variants include thee following message:
"The Swapping-Virus. (C) June, 1989 by the CIA"
Name:  @Disk Killer / @Ogre

Infects Boot sectors of hard disks and floppies

Because the infecting mechanism is triggered only after the computer
has been running for 48 hours, this virus is most likely to attack
networks.  The bootable partition of the hard disk will be encrypted,
making it impossible to boot the disk.  After part of the virus is
stored in the boot sector, it makes space for the virus in the memory,
and decrements the available memory by 8K.  The other part loads and
executes the main body of the virus.   Most diskettes used on an
infected system will be infected.
When the destructive part of the virus is activated, a warning
will be issued as follows:
"Do not turn off the power or remove the diskette while"
"Disk Killer is Processing"
After it completes the scrambling process, another message will
appear: "Now you can turn off the power. I wish you luck!"
followed by a hang system, compelling the user to turn off the
computer, and destroying the hard disk.
Name: @OHIO          Discovered: June 1988

Resident virus, infects Boot Sectors on floppy

Symptoms:
This virus is similar in many respects to the Den Zuk virus,
and is believed to be it's earlier version.  A diskette infected
with Ohio virus will not be infection by the Brain virus.
The following text strings appear in the Ohio virus:
"VIRUS by The Hackers  YC1ERP DENZUK0 Bandung 40254 Indonesia
(C) 1988, The Hackers Team...."
Name: @EDV
      @Cursy

Resident virus, infects Boot Sectors

Symptoms:
When a system is booted from an infected diskette, the virus
will install itself memory resident at the top of high system memory.
The value returned by interrupt 12 will be decreased.
Whenever a diskette or hard disk is accessed by the system, it will
become infected.
Once the virus has infected six disks, it will activate.
Upon activation, the virus will disable the keyboard interrupt and
will overwrite the first 3 tracks of each disk on the system,
starting with the hard disks.
After destroying the disks, it will display the following message:
"That rings a bell, no? From Cursy"
The following message appears at the end of the virus infected boot
sector:      "MSDOS Vers. E.D.V."
Name: @Chaos            Discovered: December 1989

Resident virus. Infects Boot Sectors

Symptoms:
First reported by James Berry of Kent in England.
This virus will infect both floppies and hard disks.
Infected boot sectors will contain the messages:
"Welcome to the New Dungeon Chaos. Letz be cool guys"
Name: @Korea            Discovered: March 1990

Resident virus, infects floppy Boot Sectors

Symptoms:
This virus is destructive but does nothing except replicate.
In some instances, it will damage the root directory of a diskette,
because it moves the original boot sector to the last sector of the
root directory.  If this sector contained directory entries, they
will be lost.
Name: @Devil's Dance        Discovered: December 1989
      @Mexican

Resident virus. Infects COM programs

Symptoms:
This virus will infect a file multiple times until the file becomes
too large to fit in available system memory.
Upon warm-boot (ALT-CTRL-DEL) will result in the following message:
"DID YOU EVER DANCE WITH THE DEVIL IN THE WEAK MOONLIGHT?"
                   "PRAY FOR YOUR DISKS!!"
                         "The Joker"
After 2000 keystrokes, colors will start changing on the screen.
After 5000 keystrokes the system will be rebooted and the FAT will
be destroyed.
Name: @Virus-90

Resident virus. Infects COM programs

Symptoms:
This virus was originally distributed as an 'Educational Tool', along
with the source code of the virus. After a month, the author had
decided that a live virus was not a good idea for education tool,
and stopped the distribution.
Name: @Joker / @Jocker           Discovered: December 1989

Non resident virus, infects EXE files, destroys DBF files

Symptoms:
Programs which are infected with this virus will display different
error messages and comments.  These messages can be found in the
infected files. Following are some examples:
"Incorrect DOS version"          "Invalid Volume ID Format failure"
"Please put a new disk into drive A:"           "End of input file"
"END OF WORKTIME.  TURN SYSTEM OFF!"              "Divide Overflow"
"Water detect in Co-processor"                   "Don't beat me !!"
"I am hungry! Insert HAMBURGER into drive A:" "NO SMOKING, PLEASE!"
"Another cup of coffee ?"                                " OH, YES!"
"Hard Disk head has been destroyed. Can you borrow me your one?"    
"In case mistake, call GHOST BUSTERS"
"Insert tractor toilet paper into printer."
Name: @V2000
      @Travel virus
      @Eddie 3

Stealth, resident virus. Infects COM and EXE programs

Symptoms:
The virus will search and infect COMMAND.COM. It will also infect
COM or EXE files whenever they are executed, copied or manipulated
in any way.  The virus hides the true length of infected files, so
the increased file length cannot be seen in DIR command.
The virus is very virulent and can cause system crashes and data loss
Some disks can become non-bootable after infection.
This virus is written in Bulgaria and contains the following
messages:
"Copy me - I want to travel"
"(c) 1989 by Vesselin Bontchev"
Name: @VALERT / @1554          Discovered: February 1990
      @Ten Bytes/@10 bytes

Resident virus, infects EXE and COM programs

Symptoms:
This virus was sent out over the VALERT-L network on Feb. 13, 1990
to approximately 600 subscribers.
This virus will infect COM files over 1000 bytes in length and
EXE files over 1024 bytes in length.
It activates in September, October, November and December of any year.
When activated any files written to the disk will miss the first
ten bytes and ten bytes of garbage will be appended to the end of the
file.  This will cause programs and data files to be corrupted.
Name: @VCOMM

Non resident virus, infects EXE programs only

Symptoms:
After the virus is first executed, it infects one other EXE file.
This virus does not stay resident in memory, but it installs
a small code turning all disk writes into reads.
This may result, for example, that the DOS COPY command no longer
works.
Name: @W13            Discovered: December 1989
      @Polish

Non resident virus, infects COM programs

Symptoms:
This virus originated in Poland, and based on Vienna virus.
Infected files have their month set to 13.
Name: @Eddie II

Resident virus, infects COM and EXE programs

Symptoms:
Contains the strings "Eddie Lives" from the Dark Avenger virus
Infected files are marked with a value of 62 in the seconds field
of the file timestamp. Infected files grow by 651 bytes, but the
increase will not be seen in the DIR command.
Name: @Solano
      Solano 2000

Resident virus. Infects COM files

Symptoms:
This virus was discovered in Solano County California on March 1990.
The virus will infect each program executed.
Some programs will not run after being infected with this virus,
instead an "Invalid drive specification" message will be displayed.
This message is not the viral code, but due to an error introduced
by the virus in passing parameters to the infected program.
This virus also randomly reverses contiguous numeric data in the video
buffer and changes color attributes.
Name: @ItaVir

Infects EXE programs

Symptoms:
The virus is activated after it has been in the system for more
than 24 hours.
The virus sequentially writes 8 bit binary numbers (0 to 255)
to all I/O ports in the system.  The result is a dramatic confusion
of all peripherals.  The printer will print garbage, the video monitor
will flicker, etc...
The virus also write over the boot sector so the disk will not be
bootable on next power-up.
Name: @AMOEBA

Infects EXE and COM programs

Symptoms:
The virus does little damage other than to corrup the infected
programs.  The virus will display the following message:
"SMA KHETAPUNK - Nouvel Band A.M.O.E.B.A."
Whatever this means.
The virus changes the date of infected files to the date of infection.
Infection includes COMMAND.COM
Name:  @PSQR               Discovered: March 1990
       @Jerusalem-PSQR
       @1720

Resident virus, infects COM and EXE files

Symptoms:
This virus, is a variant of the Jerusalem Virus, and was first
isolated in Barcelona, Spain.
The first time an infected program is executed, the virus will
install itself memory resident, and infect every program executed.
Destructive capabilities of this virus are unknown at this time.
Name:  @Prudents               Discovered: December 1989
       @1210

Resident virus, infects EXE programs

Symptoms:
This virus activates between May 1st and May 4th of any year,
causing disk writes to be changed to disk verifies, so writes to
the disk never actually occur, and the data is lost.
Name:  @Kennedy               Discovered: April 1990

Non resident virus, infects COM programs

Symptoms:
This virus has three activation dates: June 6 (assassination of
Robert Kennedy 1968), November 18 (death of Joseph Kennedy 1969),
and November 22 (assassination of John F. Kennedy 1963).
When activated, it will display a message:  "The Dead Kennedys"
This virus will cause crosslinking of files, lost clusters, and file
allocation table errors.
Name: @Pretoria                   Discovered: April 1990
      @June 16th

Encrypted, non resident virus, infects COM programs

Symptoms:
Every time an infected file is executed, the virus will search
the current drive (all directories) and infect all COM files found.
The search period can be quite long !
On June 16th of every year, virus will activate and change all
entries in the root directory and the file allocation table to
the string: "ZAPPED".
Name: @1024          Discovered: April 1990 in Bulgaria
      @Eddie III

Resident virus, infects COM and EXE programs.

Symptoms:
A Bulgarian virus, possibly earlier version of Dark Avenger.
After infection, one program will be executed.   Executing
subsequent programs will hang the system.
Name: @Fish 6                Discovered: May 1990 in Germany

Encrypted, resident stealth virus, infects COM and EXE programs

Symptoms:
This virus will remain memory resident thru a warm reboot, or
CRTL+ALT+DEL.
The first time an infected program is executed, the virus will
install itself resident in the lowest available free memory.
The Fish virus will hook the disk interrupt (13) if it was not yet
hooked by another program.
Random warm boots will appear, thus allowing infection of COMMAND.COM
and hooking of disk interrupt.  All COM and EXE programms accessed
will be infected. The increase in size will not be seen in DIR command
and CHKDSK will report lost clusters.
The virus also slows down video writes, and flickering of the screen
can be noticed.
Viewing system memory with the virus resident will show the names of
several fish types.
Name: @Liberty               Discovered: May 1989
      @Mystic

Encrypted, resident virus, infects COM and EXE programs

Symptoms:
When this virus is first executed, it will become memory resident,
in high free memory, resulting in a decrease of 8K of available
free memory.  This virus also directly changes the system interrupt
vector (21) in memory.
Every program executed will become infected; all .EXE files and COM
files over 2K in length. Overlays will also become infected.
It is not yet known if it is destructive.
Name: @Murphy
      @Murphy 2
Resident virus, infects COM and EXE files
Written in Bulgaria by Lubomir Mateev and Iani Brankov.

Symptoms:
Infects every program accessed. If an infected program is run
between 10 am 11 a.m., the speaker produces a CLICK every System
Call, thus resulting in a strange sound that gives an indication of
the activity (thinking) of the computer.
MURPHY: Contains a message:
  "Hello I am Murphy. Nice to meet you friend."
  "I am written since Nov/Dec. Copyright (c) 1989 by Lubo & Ian"
  "Sofia, UMS laboratory"
MURPHY 2: Contains a message:
  "It's me - Murphy."
  "Copywrite (c)1990 by Lubo & Ian, Sofia, USM Laboratory."
This version will wait for the system time to have the minutes set
to 0, then it will have a "bouncing ball" effect.
Name: @800

Destructive virus, Infects COM files only
Member of Bulgarian viruses family

Symptoms:
The virus writes its own code to a random section of the file,
places 3-byte JMP at the beginning of the file and appends the
original, overwritten code at the end.
The virus is harmful, because it wipes out the root directory
on hard disks.
Name: @Armagedon         Discovered: June 1990
      @GREEK

Resident virus, infects COM programs.

Symptoms:
This virus from Greece will interfere with serial ports.
Between 5:00 - 7:00, it will send to COM ports 1-4, a string for HAYS
compatible modems, which will cause dialing the number 081-141
(speaking clock in Crete).
From time to time a string "ARMAGEDON THE GREEK" will be sent to
COM ports.
Name: @JOJO               Discovered: May 1990

Resident virus, infects COM programs

Symptoms:
This virus was discovered in Israel and it contains a message:
"Welcome to the JOJO Virus." and "Fuck the system (c) - 1990".
Both messages are never displayed.
The virus will install itself in memory resident by increasing
the memory used by COMMAND.COM, by 2048 bytes.
This virus will not infect files if interrupt 13 is in use
instead it will clear the screen, and the system will hang.
If warm boot is used (ALT+CTRL+DEL) the virus will remain in memory.
Name: @July 13th              Discovered: April 1990 in Spain

Non resident virus, infects EXE programs

Symptoms:
When an infected program is executed, the virus will attempt to
infect an EXE file.
Files are only infected if they are greater than 1,201 bytes.
This virus activates on July 13th of any year.  At that time, a
bouncing ball will appear on the screen (similar to the Ping Pong
virus).
Name: @Shake                   Discovered: May 1990

Resident virus, infects COM programs

Symptoms:
This virus was discovered in Bulgaria.
When an infected program is executed, this virus will install itself
in memory resident, altering the size of COMMAND.COM in  memory.
Infected files increase in size by 476 Bytes, but the size increase
cannot be seen in DIR command.
While resident, this virus will occasionally display the message:
"Shake well before use !" when an infected program is executed. In
this case the program will terminate rather than executed.
Name: @Svir

Non resident virus, infects EXE programs.

Symptoms:
A simple virus with no side-effects.
"Svir" means music in Bulgarian
Name: @Victor            Discovered: May 1990

Resident virus, infects COM and EXE programs

Symptoms:
This virus is originated in the USSR and contains the following
message:
"Victor V1.0 The Incredible High Performance Virus"
"Enhanced versions available soon."
"This program was imported from USSR. Thanks to Ivan."
This message is never displayed.
This virus is a very slow infector, infecting approximately
1 in every 10 programs executed after it becomes memory resident.
Occasionally in the process of infecting a file, the virus will
hang the system. This may result in data corruption.
Name: @Tiny               Discovered: June 1990 in Denmark
      @163

Non resident virus, infects COM programs

Symptoms:
When an infected program is executed, the virus will attempt to
infect the first COM file greater than 1K in the current directory.
Infected files will have their date and time changed to the date and
time of infection.
This virus currently does nothing but replicate.
This virus is not connected to the Bulgarian family of tiny viruses!
Name: @Ambulance            Discovered: June 1990 in Germany
      @Red Cross

Non resident virus, infects COM programs.

Symptoms:
When an infected program is executed, it will attempt to infect
one COM file on drive C:.  This virus only infects one file in
any directory, and never the first one.
It will usualy not infect COMMAND.COM as it is normally the first
file in the root directory.
When an infected file is executed it will randomly display an
Ambulance car moving across the bottom of the screeen. The sound
of a siren will be heard. These effects only occur on systems
with a graphics display adapter.
Name: @Fellowship          Discovered: July 1990 in Australia

Resident virus, infects and destructs EXE programs

Symptoms:
The first time an infected program is executed, the virus will
install itself memory resident, taking 2K in memory.
The virus will infect EXE files when they are executed.
Infected files will contain the following message:
"This message is dedicated to all fellow PC users on Earth"
"Toward A Better Tomorrow And a better Place To Live In"
This virus will damage the last 10 bytes of the infected file.
Name: @VirDem

Non resident virus, infects COM programs

Symptoms:
This virus was written in 1986-1987 by Ralf Burger, Germany.
It was originally distributed in Europe as a demonstration virus
to assist computer users in understanding how a computer virus
operates.  When an infected program is executed, this virus will
infect the next non-infected COM file found, and play a "game" with
the following messages being displayed:
" VirDem Ver.: 1.06 (Generation #) aktive."
"Copyright by R.Burger 1986,1987"
"Phone.: D - 00000/0000"
"This is a demoprogram for computerviruses. Please put in a"
"number now.  If you're right, you'll be able to continue."
"The number is between 0 and x"
At this point, user must guess the correct number and enter it.
Name: @Blood

Non resident virus, infects COM programs.

A simple virus from South Africa, no side-effects known.
Name: @Burger          Discovered: August 1990 in South Africa

Non resident virus, destroys COM programs.

Symptoms:
It will infect one COM file located in the root directory of C:
drive. If the infected program is COMMAND.COM, the system will reboot.
Executing an infected program  will cause the cursor to cascade
down the screen and the system hangs.
Name: @Flash               Discovered: July 1990 in Germany

Resident virus, infects COM and EXE programs

Symptoms:
The first time an infected program is executed, it will install
itself resident in memory.
Once the virus is resident, each time a COM or EXE program is executed
it will be infected. COM files are infected if they are greater than
512 bytes.
After June of 1990, computers with graphic screens, will notice
flickering at approximately seven minute intervals.
Name: @Slow               Discovered: May 1990 in Australia

Resident virus, infects COM and EXE programs

Symptoms:
This virus was discovered in Australia.
COMMAND.COM is not infected by this virus.
When an infected program is executed, the virus installs itself
in memory resident. When, an executable program is opened, it is
infected. In the process of infecting some EXE files, the virus
may hang the system.
The Slow Virus is based on the Jerusalem B virus.
Other effects of this virus are unknown.
Name: @Subliminal          Discovered: May 1990

Resident virus, infects COM programs

Symptoms:
This virus appears to be a very early version of the Solano virus
and has only been reported at Solano Community College.
When the virus is memory resident, the screen will appear to flicker.
What is occurring is that the virus is attempting to flash a message
"LOVE, REMEMBER?" in the lower left corner of screen.
The actual amount of time the message displays, varies due to CPU
speed.
Name: @V1/@V-1 (Boot + COM)      Discovered: August 1990 in Austria

Resident virus, infects COM programs and Boot Sectors.

Symptoms:
RESIDENT PORTION:
The first time an infected program is executed, the virus will install
itself in memory resident.  At this time, the partition table of the
hard disk is infected with the Boot portion of V1 virus.
If the infected program was executed from a diskette, the boot sector
of this diskette will also be infected.  Any diskettes accessed, will
have their boot sector infected with V1 virus.

BOOT PORTION:
When the system is booted from the hard disk or diskette infected with
the Boot portion of V1 virus, it will also install itself in memory.
The virus will reside at the top of system memory and decrease total
memory size by 77,840 bytes.   Every COM program executed will be
infected with resident portion of V1 virus.
Name: @Joshi          Discovered: June 1990 in India

Resident virus, infects Boots Sectors and Partition Tables

Symptoms:
After a system has been booted from an infected diskette, the virus
will be resident in memory and take 6K.
On 5th of January displays a message:
"type Happy Birthday Joshi"
Unless this text is entered by the user, the computer will hang.
Name: @Print Screen       Discovered: November 1989 in India

Resident virus, infects Boot Sectors.

Symptoms:
When a system is booted from an infected diskette or hard drive,
the virus will install itself in the top of memory.
After becoming memory resident, the virus will infect any hard disk
or floppy diskette which is accessed by the system.
Slow hard disk access and garbage in root directory will be noticed.
There are two versions of Print Screen. The second version
occasionally performs a Print Screen (PrtSc) operation. The first
one has a bug which prevents the printing of the screen.
This virus is based on the Ping Pong Virus, and some anti-virus
programs will identify it as such.
Name: @Form        Discovered: June 1990 in Switzerland

Resident virus, infects Boot Sectors.

Symptoms:
When a system is booted with an infected diskette, the virus
will install itself in memory, and infect the system's hard disk.
The following text message is contained in virus code:
"The FORM-Virus sends greetings to everyone who's reading"
"this text. FORM doesn't destroy data! Don't panic!"
"Fuckings go to Corinne."

On the 24th day of every month a small delay will be produced when
keys are pressed.
Name: @Mardi Bros         Discovered: July 1990 in France
      @Sudah ada vaksin

Resident virus, infects floppy boot sectors.

Symptoms:
When a system is booted from an infected diskette, the virus will
install itself 7,168 bytes above the top of memory.
This virus will infect every diskette accessed by the system.
Infected diskettes will have their volume label changed to:
"Mardi Bros".
The boot sector will contain the following message:
"Sudah ada vaksin"     (Arabic language)
No destructive effects known.
Name: @Plastique            Discovered: July 1990 in Taiwan

Resident virus, infects EXE and COM programs

Symptoms:
The first time an infected program is executed, the virus will install
itself in memory resident.
After the virus is memory resident, it will attempt to infect any
COM or EXE file executed or opened.

Version 4.51: has many "bugs" and it is not always successful in
              infecting files when they are  executed.

Version 5.21: has some "bugs" fixed and is always successful in its
              infection.

It is yet unknown what damage this virus may do, or if it has an
activation date.
Name: @Violator         Discovered: August 1990 in USA

Non resident virus, infects COM programs

Symptoms:
When an infected program is executed, system date is checked.
If the date is prior to August 15, 1990, the virus will infect one
COM file in the current directory.
If the date is August 15, 1990 or after, the virus will not infect
any files.

The following message appears in the virus code:
"TransMogrified (TM) 1990 by RABID N'tnl Development Corp"
"Copyright (c) 1990 RABID!  Activation Date: 08/15/90"
" - Violator Strain B -"
"! (Field Demo Test Version) !"
"!  NOT TO BE DISTRIBUTED  !"
Name: @Internal        Discovered: June 1990

Non resident virus, infects EXE programs.

Symptoms:
Each time an infected program is executed, the virus will infect
one EXE file on the current drive.  It will infect  files greater
than 1,300 bytes.

The following message can be found in the virus code:
"INTERNAL ERROR 02CH."
"PLEASE CONTACT YOUR HARDWARE MANUFACTURER IMMEDIATELY !"
"DO NOT FORGET TO REPORT THE ERROR CODE !"


No destructive activities of this virus are known.
Name: @Microbes         Discovered: June 1990 in India

Resident virus, infects floopy and hard disk boot sectors.

Symptoms:
The system may hang upon booting from infected disk or diskette.
Inserting new diskette to boot from, will result in this new diskette
becoming infected.
Name: @Nomenklatura          Discovered: August 1990 in Holland

Resident virus, infects EXE and COM programs.

Symptoms:
The first time an infected program is executed, the virus installs
itself in memory resident at the the top of system memory.
Any program executed or opened will be infected. Attempt to infect
a program on a write-protected diskette will result in a
"SECTOR NOT FOUND" error.
The name "NOMENKLATURA" appears in the virus code.
Name: @Tiny Family     Origin: Bulgaria
      Tiny-@134, Tiny-@138, Tiny-@143, Tiny-@154, Tiny-@156
      Tiny-@158, Tiny-@159, Tiny-@160, Tiny-@167, Tiny-@198

Resident virus, infects COM programs only

Symptoms:
All the viruses in this family share the same characteristics,
except difference in size.
The first time an infected programis is executed, the virus will
install itself in memory at memory segment 0060h. This area of memory
is only used by DOS when the system is booted, and thus free.
Every COM program executed will be infected.
The Tiny Family of Viruses  do nothing but replicate.
Name: @Whale          Discovered: August 1990 in Germany
      @Mother Fish

Resident, stealth virus, infects COM and EXE programs

Symptoms:
When the infected program is executed, this virus installs itself
on top of system memory, taking 9,984 bytes.
Every program executed or opened, will be infected. However increase
in size will not be seen using the DIR command. CHKDSK will report
lost and cross linked clusters.  CHKDSK/F will damage all infected
files!
Infected system will experience slowdown, video flickering, slow sceen
writes, program hanging and occasional reboot.
A hidden file is created in root directory of drive C: - "FISH-#9.TBL"
which contains hard disk partition table image and some messages.
There are some bugs in the virus code, which will sometimes cause it
to fail to infect a program file or create invalid directory entries.
Name: @Flip            Discovered: July 1990 in Germany

Resident virus, infects COM and EXE programs

Symptoms:
When an infected progarm is executed, it installs itself on top
of system memory, taking 3,064 bytes.
COMMAND.COM in drive C: will be immediately infected, and partition
table and boot sector will be slightly modified.
Every COM, EXE and OVL program executed will become infected.
Size change of infected programs cannot be seen in DIR command, and
CHKDSK will produce lost clusters and allocation errors.
Some data files may also become corrupted.
Name: @Aids II           Discoverd: April 1990

Destructive companion virus for EXE programs

Symptoms:
Unlike other program viruses, the AIDS II Virus is the first known
virus to use a "Companion Technique" of infection, so that the
original program is never changes. This virus takes advantage
of the DOS feature in which a file with a COM extention will be
executed in the same directory before a file with an EXE extention
of the same name.
When the program is called, the virus infected COM file will play
a melody and display the following message:
"Your Computer is infected with ... Aids Virus II"
"- Signed WOP & PGT of DutchCrack -"
When the program terminates, the melody is again played with the
following message:
"Getting used to me? Next time use a Condom ..."
No information is currently available about this virus.
Hard Disk Partition Table Virus:

This virus attacks the partition table of the Hard disk or
the boot sectors of diskettes.

Symptoms:
This type of virus destroys the partition table and/or the
FAT and the directories.
This type of virus is easily removable with the Advanced
Feature: "Repair Master Hard Disk & Boot Sector" included in
ViruSafe.DOS Boot Sector Virus:

This virus attacks the Hard Disk DOS Boot Sector and/or the
Boot sector of floppy diskettes.  It operates by creating
seemingly bad clusters on the disk and can cause the
destruction of the FAT and the Directory.
It can be easily removed by using the SYS command from a
new (clean) DOS diskette.Resident File Virus:

This type of virus sticks to programs.  When an infected
program is loaded, the virus installs itself in the memory
and from there, will infect any other program that is
executed or even when it is accessed.
This virus produces a variety of side-effects ranging from a
possible malfunction of the computer, slowdown of the
computer activity, filling up the available space of the
computer, and destroying the disk.Non-Resident File Virus:

This virus infects programs. When executed, it searches
for an uninfected program to infect.
It produces a variety of side-effects ranging from a
possible malfunction of the computer, slowdown of the
computer activity, filling up the available space of the
computer, and destroying the disk.Destructive virus:

This is a virulent virus that destroys the program that it
infects.  The infected program becomes inoperable, and
actually becomes the virus itself.
It produces a variety of side-effects ranging from a
possible malfunction of the computer, slowdown of the
computer activity, filling up the available space of the
computer, and destroying the disk.
This virus must be erased IMMEDIATELY!